GitHub narrows when weekly code scans begin

GitHub has changed what counts as activity for weekly scheduled scans in code scanning default setup and GitHub Code Quality. According to a GitHub changelog entry dated October 1, 2026, weekly scans now start only after a push or pull request triggers an analysis.

Until now, GitHub says, activity was judged by any unscheduled scan. That included the one-time validation scan that runs when default setup is first enabled, and scans triggered by a change in detected languages. GitHub says this meant that enabling default setup, or rolling out a security configuration across many repositories at once, could make a dormant repository look active for another six months and set off weekly scans nobody expected.

Under the current behavior, as GitHub describes it, enabling default setup still runs an initial validation scan and shows findings right away. Weekly scheduled scanning begins only once a push or pull request triggers an analysis. GitHub adds that the determination rests on analysis history, not on Git activity from before scanning was enabled, and that activity continues to be shared between code scanning and Code Quality.

The change applies to GitHub Enterprise Cloud today and, according to the changelog, will be supported in GitHub Enterprise Server 3.24. GitHub says no configuration change is needed.

What is confirmed and what is not: everything above comes from GitHub's own changelog entry, which is the only source for this item. We found no independent coverage, and GitHub's documentation pages we located describe the older inactivity rules and do not yet mention this change. The effect GitHub predicts, fewer unexpected weekly scans on repositories without recent development, is a company expectation rather than a measured result.

Why it matters: administrators who apply security configurations across many repositories have had a way for dormant projects to pick up scheduled scans simply because scanning was switched on. Tying the weekly schedule to real development activity should make scan volume more predictable at scale, if the change works as described.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.